CVE-2026-12064

A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP (SSH File Transfer Protocol) or SCP (Secure Copy Protocol) as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect to an unverified SSH remote host without alerting the user. This could enable an attacker to intercept or manipulate data through a man-in-the-middle attack.

This Important flaw in curl allows an attacker to bypass SSH host verification when a user invokes curl with a schemeless URL and specifies SFTP or SCP as the default protocol. This can lead to man-in-the-middle attacks, enabling data interception or manipulation without user awareness in Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using the --proto-default sftp or --proto-default scp options with schemeless URLs when invoking the curl command. Instead, explicitly specify the protocol in the URL (e.g., sftp://host/path or scp://host/path).